Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

twisted

22 known vulnerabilities (9 high, 6 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
26.10.0 (Oct 30, 2026): no advisory affects it
Newest unaffected release
26.10.0 (Oct 30, 2026), the latest release
Advisories
22 · 9 high, 6 medium, 1 low
Weekly downloads
3.7M
Dependents
1,493
Releases
99 since 2.1.0
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 22 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 22

  • Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

    Affected: fixed in 26.10.0rc1.

    Fixed in 26.10.0rc1 (released Oct 22, 2026, 7 days before disclosure).

    The latest release, 26.10.0, is not affected.

  • CVE-2026-115877Medium 5.4

    Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

    Affected: fixed in 26.10.0rc1.

    Fixed in 26.10.0rc1 (released Oct 22, 2026, 1 day before disclosure).

    The latest release, 26.10.0, is not affected.

  • Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

    Affected: fixed in 26.10.0rc1.

    Fixed in 26.10.0rc1 (released Oct 22, 2026, 1 day before disclosure).

    The latest release, 26.10.0, is not affected.

  • Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

    Affected: fixed in 26.10.0rc1.

    Fixed in 26.10.0rc1 (released Oct 22, 2026, 1 day before disclosure).

    The latest release, 26.10.0, is not affected.

  • Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

    Affected: fixed in 26.10.0rc1.

    Fixed in 26.10.0rc1 (released Oct 22, 2026, 1 day before disclosure).

    The latest release, 26.10.0, is not affected.

  • Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

    Affected: fixed in 26.10.0rc1.

    Fixed in 26.10.0rc1 (released Oct 22, 2026, 1 day before disclosure).

    The latest release, 26.10.0, is not affected.

  • CVE-2026-115774Medium 4.9

    Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

    Affected: fixed in 26.10.0rc1.

    Fixed in 26.10.0rc1 (released Oct 22, 2026, 1 day before disclosure).

    The latest release, 26.10.0, is not affected.

  • CVE-2026-106454Medium 4.3

    Twisted: IMAP wildcardToRegexp() ReDoS

    Affected: through 26.4.0; through 25.5.0.

    Fixed in 26.10.0 (released Oct 30, 2026, 24 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 26.10.0, is not affected.

  • Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains

    Affected: fixed in 26.4.0; fixed in 26.4.0rc2.

    Fixed in 26.4.0 (released May 11, 2026, 2 days before disclosure).

    The latest release, 26.10.0, is not affected.

  • CVE-2024-41810Medium 6.1

    HTML injection in HTTP redirect body

    Affected: fixed in 24.7.0rc1.

    Fixed in 24.7.0rc1 (released Jul 29, 2024, the day of disclosure).

    The latest release, 26.10.0, is not affected.

  • twisted.web has disordered HTTP pipeline response

    Affected: fixed in 24.7.0rc1.

    Fixed in 24.7.0rc1 (released Jul 29, 2024, the day of disclosure).

    The latest release, 26.10.0, is not affected.

  • CVE-2023-46137Medium 5.3

    twisted.web has disordered HTTP pipeline response

    Affected: fixed in 23.10.0rc1; fixed in 23.10.0rc1.

    Fixed in 23.10.0rc1 (released Oct 24, 2023, 1 day before disclosure).

    The latest release, 26.10.0, is not affected.

  • CVE-2022-39348Medium 5.4

    Twisted vulnerable to NameVirtualHost Host header injection

    Affected: from 0.9.4, fixed in 22.10.0rc1.

    Fixed in 22.10.0rc1 (released Oct 26, 2022, the day of disclosure).

    The latest release, 26.10.0, is not affected.

  • HTTP Request Smuggling in twisted.web

    Affected: fixed in 22.4.0.

    Fixed in 22.4.0 (released Apr 11, 2022, 7 days after disclosure).

    The latest release, 26.10.0, is not affected.

  • Buffer Overflow in Twisted

    Affected: from 21.7.0, fixed in 22.2.0.

    Fixed in 22.2.0 (released Mar 3, 2022, the day of disclosure).

    The latest release, 26.10.0, is not affected.

Show all 22 advisoriesShow fewer advisories

  • Cookie and header exposure in twisted

    Affected: from 11.1.0, fixed in 22.1.0.

    Fixed in 22.1.0 (released Feb 7, 2022, the day of disclosure).

    The latest release, 26.10.0, is not affected.

  • In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability.

    Affected: fixed in 20.3.0rc1; fixed in 20.3.0.

    Fixed in 20.3.0 (released Mar 20, 2020, 8 days after disclosure).

    The latest release, 26.10.0, is not affected.

  • In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability.

    Affected: fixed in 20.3.0; fixed in 20.3.0rc1.

    Fixed in 20.3.0 (released Mar 20, 2020, 8 days after disclosure).

    The latest release, 26.10.0, is not affected.

  • Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI…

    Affected: fixed in 16.3.1.

    Fixed in 16.3.1.

    The latest release, 26.10.0, is not affected.

  • Python Twisted 14.0 trustRoot is not respected in HTTP client

    Affected: from 14.0.0, fixed in 14.0.1; fixed in 14.0.1.

    Fixed in 14.0.1.

    The latest release, 26.10.0, is not affected.

  • In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an…

    Affected: fixed in 19.7.0rc1; fixed in 19.7.0rc1.

    Fixed in 19.7.0rc1.

    The latest release, 26.10.0, is not affected.

  • In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters…

    Affected: fixed in 19.2.1; fixed in 19.2.1.

    Fixed in 19.2.1.

    The latest release, 26.10.0, is not affected.